Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-98845— tpm: Disable TPM on null key name mismatch

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： TPM：在空密钥名称不匹配时禁用 TPM 空密钥名称检查机制旨在防止 TPM 重置攻击，因此当检测到不匹配时，应停止该设备继续处理后续请求。然而，当前实现并未在发现不匹配时禁用芯片。 系统会记录不匹配事件： 但芯片仍继续处理命令，例如： 问题根源在于 函数：该函数在执行空密钥名称检查时，仅当返回值 非零时才将芯片标记为禁用。然而，在检测到不匹配时， 此时仍为零，导致函数返回成功。另一个问题是，调用方期望在函数返回 0 时，空密钥句柄已被正确填充；但此处函数虽返回 0，却

AI Predicted 7.5 Difficulty: Moderate EPSS 0.16% · P4

Affected Version Matrix 14

VendorProduct Version RangeStatus
Linux Linux cc7d8594342a25693d40fe96f97e5c6c29ee609c< a03d0c64cd827a622578623a78defd66b6593b82 affected
cc7d8594342a25693d40fe96f97e5c6c29ee609c< 96c46c75b0d470b4204f9fe1bdb075cd2ebaebfa affected
cc7d8594342a25693d40fe96f97e5c6c29ee609c< f6599d8830fe7ddab7334cc17846fd9ac9a7fa50 affected
cc7d8594342a25693d40fe96f97e5c6c29ee609c< 015fb29a748342a186f37b602ac70017098c8251 affected
294984ce51c19c2af3d0d71e1c8bd589bc86b8e2 affected
386c7cc6c06d64cbf36d15c5e2319814765e107c affected
6.11.7< 6.12 affected
6.11.10< 6.12 affected
… +6 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-98845

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
tpm: Disable TPM on null key name mismatch
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: tpm: Disable TPM on null key name mismatch The null key name check exists to protect against TPM reset attacks, so a mismatch should stop the device from serving further requests. Currently it does not disable the chip when it finds a mismatch. The mismatch is logged: tpm tpm0: null key integrity check failed but the chip keeps serving commands: / # tpm2_getcap -c properties-fixed TPM_PT_FAMILY_INDICATOR: as UINT32: 0x08322e3000 as string: "2.0" ... tpm2_load_null() where the null key name check is run sets the chip as disabled only if the rc is non zero. When the mismatch is seen, rc is zero at that point and it returns success. The other issue is that the caller expects the null key handle to be populated when the function returns 0 which it does here without writing the handle and proceeds assuming the null key handle is valid. During the test, I noticed that tpm2_start_auth_session() uses the uninitialized stack value as the key handle since tpm2_load_null() returns 0 despite the integrity failure and proceeds with TPM2_CC_START_AUTH_SESS with this value as salt key handle. Set rc to -ENODEV on the mismatch. The error path then disables the chip and returns the correct code to the caller. Tested in QEMU with swtpm and CONFIG_TCG_TPM2_HMAC=y by making TPM2_CC_CONTEXT_LOAD fail with TPM2_RC_INTEGRITY and changing the name of the re-created null key. The chip is now disabled on the mismatch.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux cc7d8594342a25693d40fe96f97e5c6c29ee609c ~ a03d0c64cd827a622578623a78defd66b6593b82 -
Linux Linux 6.12 -

II. Public POCs for CVE-2026-98845

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-98845

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-98845 (2)

Same Patch Batch · Linux · 2026-10-18 · 435 CVEs total

CVE-2026-98719 KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it
CVE-2026-98732 Bluetooth: btintel: fix buffer over-read in btintel_hw_error()
CVE-2026-98731 Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()
CVE-2026-98730 Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()
CVE-2026-98729 x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h
CVE-2026-98728 tpm: fix off-by-four bounds check in tpm2_get_random()
CVE-2026-98727 nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known
CVE-2026-98726 nvme-multipath: fix underflow in ANA log bounds checks
CVE-2026-98725 nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()
CVE-2026-98724 nvmet: pci-epf: reject too-short SGL segments
CVE-2026-98723 nvmet: copy the hostid into the ctrl before creating PR pc_refs
CVE-2026-98722 mtd: block2mtd: Fix divide error when erase_size is zero
CVE-2026-98721 mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ
CVE-2026-98720 KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified
CVE-2026-98707 wifi: mac80211: shut down RX BA session timer on teardown
CVE-2026-98711 wifi: cw1200: fix TX padding OOB read leaking heap data to device
CVE-2026-98710 wifi: iwlegacy: 3945: free EEPROM data on remove
CVE-2026-98709 wifi: mac80211: count only matching reservations in reserved switch
CVE-2026-98712 KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq
CVE-2026-98708 wifi: mac80211: keep paired old chanctx alive

Showing top 20 of 435 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-98845

No comments yet

Leave a comment